(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host is vulnerable to a directory traversal flaw.\n\nThe remote
host is running Keene Digital Media Server, a web application for Microsoft Windows
designed to share media files on the Internet. The version installed on the remote host has
been reported to be prone to a directory traversal issue. An attacker may gain read access
on files outside the web root.
Solution: Upgrade or patch according to vendor recommendations.
CVE Not available
Keene Digital Media Server < 1.0.4 Directory Traversal and Authentication Bypass
PVS ID: 2165 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running Keene Digital Media Server, a web application for Microsoft Windows designed
to share media files on the Internet. The version installed on the remote host has been
reported prone to several vulnerabilities including a directory traversal issue and an
authentication bypass issue. An attacker may gain read access on files outside the web root
or access the administrative module without authentication.
Solution: Upgrade to version 1.0.4 or higher.
CVE-2004-2419
Webmatic < 1.9.0 Multiple Vulnerabilities
PVS ID: 2166 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is missing a critical security patch or upgrade.\n\nThe
remote host is running Webmatic, a web portal application. It is reported that this version of
Webmatic is prone to several unknown security issues.
Solution: Upgrade to Webmatic 1.9.0 or higher.
CVE Not available
HastyMail HTML Attachment Content-Disposition Header XSS
PVS ID: 2167 FAMILY: Web Servers
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:14370
Description: Synopsis :\n\nThe remote host is vulnerable to a Script Injection attack.\n\nThe remote host
is running HastyMail, a PHP-based mail client application. There is a flaw in the remote
version of this software that may allow an attacker to execute arbitrary javascript code on
the hosts of users of this software. To exploit this flaw, an attacker would need to send an
email to a victim using HastyMail containing a malicious HTML attachment. When the
victim attempts to read the attachment, a web browser may attempt to render the HTML
file. An attacker may use this flaw to steal the cookies of the victim and therefore get
access to their mailbox or perform other attacks.
Family Internet Services 541